CVE-2014-6140

IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Dec/3	Exploit
http://www.securitytracker.com/id/1031306
http://www.securityfocus.com/bid/71424
http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html	Exploit
https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components	Exploit
http://www-01.ibm.com/support/docview.wss?uid=swg21691701	Vendor Advisory
http://www.securityfocus.com/archive/1/534131/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:tivoli_endpoint_manager_mobile_device_management:*:*:*:*:*:*:*:*

Information

Published : 2014-12-06 07:59

Updated : 2018-10-09 12:50

NVD link : CVE-2014-6140

Mitre link : CVE-2014-6140

JSON object : View

CWE

CWE-310

Cryptographic Issues

Advertisement

Products Affected

ibm

tivoli_endpoint_manager_mobile_device_management

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://seclists.org/fulldisclosure/2014/Dec/3", "name": "20141202 [RT-SA-2014-012] Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "http://www.securitytracker.com/id/1031306", "name": "1031306", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/71424", "name": "71424", "tags": [], "refsource": "BID"}, {"url": "http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html", "name": "http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components", "name": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21691701", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21691701", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/archive/1/534131/100/0/threaded", "name": "20141202 [RT-SA-2014-012] Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-6140", "ASSIGNER": "psirt@us.ibm.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-12-06T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:tivoli_endpoint_manager_mobile_device_management:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:50Z"}